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REMARKS 

The present application was filed on January 2, 2001 with claims 1-17. In the outstanding 
Office Action dated January 13, 2005, the Examiner has: (i) rejected claims 1-17 under 35 U.S.C. 
§112, second paragraph as being indefinite; (ii) rejected claims 13-17under35U.S.C. §101 as being 
an improper definition of a process; (iii) rejected claims 1, 4, 6-8, 10 and 12-17 under 35 U.S.C. 
§ 103(a) as being unpatentable over U.S. Patent No. 6,154,844 to Touboul et al. (hereinafter 
"Touboul '844"), in view of U.S. Patent No. 6,094,73 1 to Waldin et al. (hereinafter "Waldin"), and 
in further view of U.S. Patent No. 5,699,431 to Van Oorschot et al. (hereinafter "Van Oorschot"); 
(iv) rejected claims 2 and 3 under § 103(a) as being unpatentable over Touboul '844, in view of 
Waldin, in view of Van Oorschot, and in further view of U.S. Patent No. 6,092,194 to Touboul 
(hereinafter "Touboul ' 1 94"); (v) rejected claim 5 under § 1 03(a) as being unpatentable over Touboul 
'844, in view of Waldin, in view of Van Oorschot, and in further view of U.S. Patent No. 6,275,937 
to Hailpern et al. (hereinafter "Hailpern"); (vi) rejected claim 9 under § 103(a) as being unpatentable 
over Touboul '844, in view of Waldin, in view of Van Oorschot, in view of Hailpern, and in further 
view of U.S. Patent No. 5,78 1 ,629 to Haber et al. (hereinafter "Haber"); and (vii) rejected claim 1 1 
under §103 (a) as being unpatentable over Touboul '844, in view of Waldin, in view of Van 
Oorschot, and in further view of U.S. Patent No. 6,233,577 to Ramasubramani et al. (hereinafter 
"Ramasubramani"). 

In this response, claim 14 has been canceled without prejudice, and claims 1 , 6, 8, 12, 1 3 and 
15-17 have been amended. Applicants traverse the §112 and § 103(a) rejections for at least the 
reasons set forth below. Applicants respectfully request reconsideration of the present application 
in view of the above amendments and the following remarks. 

Claims 6, 8 and 12 have been amended to eliminate the respective multiple dependencies 
therein. Accordingly, withdrawal of the objection to claims 8 and 1 2 under 37 CFR 1 .75(c) as being 
in improper multiple dependent form (Office Action; page 12, lines 9-13) is respectfully requested. 

Claims 1-17 stand rejected under 35 U.S.C. §112, second paragraph, as being indefinite. The 
Examiner contends that Applicants fail to "meet the requirements of redefining a term as set forth 
in the MPEP § 2106" (Office Action; page 2, last paragraph). Specifically, the Examiner contends 
that the term "certificate" recited in claims 1-17 "is used by the claim to mean, 'an identifier to 
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indicate that a file is virus-free,'" which is not the accepted meaning of the term (Office Action; 
page 3, first paragraph). Furthermore, the Examiner contends that such term "is indefinite because 
the specification does not clearly redefine the term." Id. Applicants respectfully disagree with the 
Examiner's contentions. 

First, MPEP § 2106 describes what is considered patentable subject matter regarding 
computer-related inventions and does not appear to set forth any requirements for redefining terms 
in a claim, although MPEP § 21 1 1.01 addresses this topic. Second, Applicants do not believe that 
the term "certificate" as used in the subject claims is defined in a manner inconsistent with the plain 
meaning of the term. The term "certificate" can be defined in the general sense simply as "a 
document testifying to the truth of something" {The American Heritage® Dictionary of the English 
Language, Fourth Edition, Houghton Mifflin Company, 2000). As used in claims 1-17, the term 
"virus-free certificate" may be defined as data (e.g., a metatag) associated with a particular file 
which attests to the fact that the file is indeed virus-free. This meaning is clearly consistent with the 
customary meaning given to the term by those skilled in the art, as set forth in MPEP § 21 1 1.01. 

Even assuming, arguendo, that the term "certificate" is used in a manner inconsistent with 
the ordinary meaning of the term, Applicants assert that the term "certificate" is clearly defined in 
the present specification, at least beginning on page 8, line 19. The specification states that "[a] 
certificate is a structure that contains a public value (i.e., a public key) associated with an identity. 
For instance, within a X.509 Certificate, the public key is bound to a 'user's name'. A third party 
(a Certificate Authority) attests that the public key belongs to the user" (specification; page 8, lines 
20-24). The specification provides further definition of the term by detailing components of an 
illustrative X.509 Certificate (specification; page 8, line 24, to page 9, line 19). Accordingly, 
Applicants submit that the term "certificate' is not indefinite. 

With regard to claims 13-17, the Examiner contends that these claims are also indefinite 
since they "do not set forth any steps involved in the method/process" (Office Action; page 3, 
paragraph 2). Applicants respectfully disagree with this contention and assert that claims 13-17 are 
proper product-by-process claims, as set forth in MPEP §2113. The MPEP, in §21 13, clearly states 
that "product-by-process claims are not limited to the manipulations of the recited steps, only the 
structure implied by the steps " (emphasis added). Claim 13, for example, is directed to "[a] system 
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comprising means," wherein the "means" comprised in the system is specifically adapted for 
carrying out the method steps recited in claim 1. Notwithstanding the above traversal, however, 
claims 13-17 have been amended in a manner which is believed to address the Examiner's § 1 12 
rejection. Specifically, these claims have been recast into independent form similar in scope to 
claim 1 . 

For at least the above reasons, Applicants respectfully request withdrawal of the §112 
rejections of claims 1-17. 

Claims 13-17 stand rejected under 35 U.S.C. §101. In this regard, the Examiner contends 
that "the claimed recitation of a use, without setting forth any steps involved in the process, results 
in an improper definition of aprocess" (Office Action; page 3, paragraph 3). Applicants respectfully 
disagree with this contention. Claims 13-17 set forth a system, computer program, article of 
manufacture, computer program product, and a program storage device, respectively, each adapted 
for carrying out the specific method set forth in claim 1 , and are thus believed to be proper product- 
by-process claims, in accordance with MPEP §2113. However, claims 13-17 have been amended 
in a manner which is believed to address the rejection under § 101. Accordingly, withdrawal of the 
§101 rejection of claims 13-17 is respectfully requested. 

Claims 1,4, 6-8, 10 and 12-17 stand rejected under 35 U.S.C. § 103(a) as being unpatentable 
over Touboul '844, in view of Waldin and Van Oorschot. With regard to independent claim 1, as 
well as claims 13 and 15-17 which are of similar scope, the Examiner contends that Touboul '844 
discloses all of the steps set forth in claim 1, but acknowledges that Touboul '844 "does not teach 
a virus-free certificate" (Office Action; page 4, line 17). The Examiner further contends, however, 
that "Waldin discloses certifying a file is virus free" (Office Action; page 4, line 18). Applicants 
respectfully disagree with the Examiner's contentions. Waldin is directed to techniques for quickly 
detecting viruses in computer files that are transmitted over a computer network (Waldin; column 
1, lines 14-16). Rather than computing a hash value for an entire file, which can take longer to 
perform than an actual antivirus scan for that file, Waldin teaches a methodology which "yields the 
security of a full file hash while requiring a hash to be taken on only a minimal set of sectors from 
the file in question" (Waldin; column 3, lines 37-39). 
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While Applicants respectfully disagree that the combination of Touboul 4 844 and Waldin 
teach all of the limitations set forth in claims 1,13 and 15-17, these claims have been amended to 
further clarify the distinguishing features of the claimed invention. Specifically, neither Touboul 
' 844 nor Waldin teaches or suggests the step of "searching through at least one cache of stored virus- 
free certificates to determine whether one of the stored virus-free certificates corresponds to the 
file," as required by amended claims 1, 13 and 15-17. The prior art of record fails to teach or 
suggest at least this feature of the claimed invention. 

As stated above, the Examiner acknowledges that Touboul '844 simply fails to disclose 
virus-free certificates at all. Moreover, Waldin fails to supplement the deficiencies of Touboul ' 844. 
While Waldin may disclose certifying that a file is virus free, as the Examiner contends (Office 
Action; page 4, line 18), such certification is done in the general sense and is not based at all on 
searching through stored virus-free certificates , as in required by the claimed invention. 
Furthermore, Waldin fails to disclose a methodology including the step of searching through stored 
virus-free certificates which is performed in a firewall, as required by the subject claims. 

In contrast to the invention set forth in claim 1 , as amended, Waldin, with reference to FIGS. 
1 and 5, states: 

At step 57, the contents of file 4 are decoded. Module 5' determines the size of file 
1 , and compares this determined size versus the size of file 1 that has been previously 
stored in file 4. If these two number are different, module 5' concludes that the 
contents of file 1 have changed in some way, and commands module 3 ' to rescan the 
entire file 1 for viruses (step 37) . . . Also in step 57, module 5' determines the date 
that virus definitions were most recently updated to scan module 3' and compares 
this determined date versus the date contained within file 4. If these two dates are 
different, module 5' commands module 3' to rescan the entire file 1 for viruses (step 
37) . . . Also in step 57, module 5' determines the version number of scan module 
3', and compares this version number with the version number stored within file 4. 
If these two numbers are different, module 5' commands module 3' to rescan the 
entire contents of file 1 for viruses (step 37) . . . (Waldin; column 6, lines 18-36) 

Although Waldin may disclose comparing certain sectors of the file (file size, date, version number) 
with stored values corresponding to those sectors, Waldin clearly fails to teach or suggest searching 
for a stored virus-free certificate corresponding to the received file, and furthermore fails to teach 
or suggest that such a step is performed in a firewall, as required by amended claim 1. Rather, 
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Waldin discloses that the above method is performed "at the recipient computer " (Waldin; column 
6, lines 16-17; emphasis added). Neither Touboul '844, Waldin, nor Van Oorschot, when 
considered either individually or in combination, teaches or suggests the step of "searching through 
at least one cache of stored virus-free certificates to determine whether one of the stored virus-free 
certificates corresponds to the file," as recited in claim 1. 

As set forth in the present specification, rather than rebuilding a virus-free certificate for each 
file received, a corresponding stored virus-free certificate is retrieved for the file, if available, thus 
saving considerable time (specification; page 12, lines 13-20). Additionally, multiple authorities 
can be employed to build a virus-free certificate for a particular file, thereby distributing the 
processing burden associated with the creation of a virus-free certificate (specification; page 12, 
lines 21-24). 

Applicants further submit that Touboul '844 fails to teach or suggest at least the step of 

"forwarding the file with the corresponding stored virus-free certificate " (emphasis added) if the file 

is determined to be virus-free, as required by amended claim 1 . The Examiner contends, however, 

that this step is disclosed in Touboul '844, as depicted in FIG. 7, blocks 760 and 770 (Office Action; 

page 4, lines 10-11). Applicants respectfully disagree with this contention. While Touboul '844 

may disclose that "[i]f each DSP 215 passes, then the local security policy analysis engine 530 in 

step 770 instructs the retransmission engine 540 to pass the Downloadable" (Touboul '844; column 

10, lines 16-18), Touboul '844 fails to teach or suggest forwarding the Downloadable along with 

a corresponding virus-free certificate , as explicitly recited in claiml. In contrast to the claimed 

invention, the Downloadable file which is passed to the computer client in step 770 (Touboul '844; 

Figure 7) is stripped of any inspector certificate in step 710, and thus teaches away from the claimed 

invention. With reference to FIG. 7, Touboul '844, at column 9, lines 21-26, states: 

Method 700 begins with the Downloadable file interceptor 505 in step 705 receiving 
a Downloadable file. The file reader 5 1 0 in step 7 1 0 extracts the Downloadable 150 , 
and in step 715 instructs the certificate authenticator 515 to authenticate the 
developer certificate 155 as from a trusted developer 120. (emphasis added) 

It is clear from the above disclosure that the Downloadable 150 passed along in step 770 only 
includes the Downloadable 205 and the developer certificate 155 (if present), as shown in FIG. 2, 
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and fails to include any virus-free certificate associated with the file. Furthermore, Waldin fails to 
supplement the deficiencies of Touboul 6 844. Although Waldin may disclose computing hash values 
for certain sectors of the file, Waldin does not teach or suggest forwarding the file along with a 
corresponding stored virus-free certificate, as required by amended claim 1 . Neither Touboul '844, 
Waldin, nor Van Oorschot, when considered either individually or in combination, teaches or 
suggests the step of "forwarding the file with the corresponding stored virus-free certificate," recited 
in claim 1 . 

For at least the above reasons, Applicants assert that claims 1 and 13-17 are patentable over 
the prior art. Accordingly, favorable reconsideration and allowance of these claims are respectfully 
requested. 

With regard to claims 4, 6-8, 10 and 12, which depend from claim 1 , Applicants submit that 
these claims are also patentable over the prior art of record by virtue of their dependency from claim 
1 , which is believed to be patentable for at least the reasons set forth above. Moreover, one or more 
of these claims define additional patentable subject matter in their own right. For example, claim 
8 further defines the step of determining whether the file is virus-free or not as comprising the step 
of "discarding the file" if the file is not virus-free. With regard to claim 8, the Examiner contends 
that Touboul '844 discloses such additional feature in step 765 of FIG. 7 (Office Action; page 6, 
lines 9-10). However, Applicants respectfully disagree with this contention and assert that Touboul 
'844 fails to disclose discarding any files that are not virus-free. Instead, with regard to step 765, 
Touboul discloses that "[i]f a DSP 215 fails, then the local security policy analysis engine 530 in 
step 765 stops the Downloadable and sends a substitute non-hostile Downloadable to the computer 
client 130 to inform the computer client 130 of the failure" (Touboul '844; column 10, lines 18-22). 
Nowhere does Touboul '844 disclose the disposition of the Downloadable which does not pass all 
DSPs. Moreover, sending a substitute non-hostile Downloadable is not reasonably analogous to 
discarding a file, as required by claim 8. 

Likewise, claim 12 further defines the step of forwarding the file with the new virus-free 
certificate as including the step of "updating a cache with the new virus-free certificate." With 
regard to claim 12, the Examiner contends that Touboul '844 discloses updating a cache, which the 
Examiner analogizes to data storage device 330 in FIG. 3, with a new virus-free certificate, which 
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the Examiner analogizes to the signed Downloadable 150 in FIG. 2 (Office Action; page 6, 
paragraph 1). Applicants respectfully disagree with this contention and submit that, while Touboul 
'844 may disclose a data storage device 330 in which signed Downloadables 150 may be stored 
(Touboul '844; FIG. 3), Touboul '844 fails to teach or suggest any updating step performed by the 
virus-free certificate firewall itself, as required by claim 12. Rather, in contrast to claim 12, the 
signed Downloadable 150 stored in data storage device 330 is not analogous to the new virus-free 
certificate set forth in claim 12, since the Downloadable 150 has not been inspected and forwarded 
by the firewall at this point. Moreover, Touboul ' 844 fails to disclose updating a cache with the new 
virus-free certificate as part of the step of forwarding the file and associated new virus-free 
certificate (e.g., to a client workstation), as required by claim 12. 

For at least the reasons given above, Applicants submit that claims 4, 6-8, 10 and 12 are 
believed to be patentable over the prior art of record, not merely by virtue of their dependency from 
claim 1 , but also in their own right. Accordingly, favorable reconsideration and allowance of claims 
4, 6-8, 10 and 12 are respectfully solicited. 

Claims 2 and 3 stand rejected under § 103(a) as being unpatentable over Touboul '844 in 
view of Waldin, Van Oorschot and Touboul '194. The Examiner acknowledges that the 
combination of Touboul '844, Waldin and Van Oorschot fails to teach the additional steps set forth 
in claims 2 and 3 (Office Action; page 7, lines 6-11). However, the Examiner contends that such 
steps are disclosed in Touboul ' 1 94. Although Applicants respectfully disagree with the Examiner's 
contentions in this regard, Applicants submit that claims 2 and 3, which depend from claim 1, are 
also patentable over the prior art of record by virtue of their dependency from claim 1, which is 
believed to be patentable for at least the reasons set forth above. Accordingly, favorable 
reconsideration and allowance of claims 2 and 3 are respectfully requested. 

Claims 5, 9 and 1 1 stand rejected under § 103(a) as being unpatentable over Touboul '844, 
Waldin and Van Oorschot, in further view of one or more of Hailpern, Haber and Ramasubramani. 
With regard to claims 5, 9 and 11, which depend from claim 1, Applicants submit that these claims 
are also patentable over the prior art of record by virtue of their dependency from claim 1 , which 
is believed to be patentable for at least the reasons set forth above. Moreover, one or more of these 
claims define additional patentable subject matter in their own right. 
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For example, claim 9 further defines the step of authenticating the virus-free certificate as 
comprising the steps of validating the virus-free certificate, the virus-free certificate including a list 
of one or more anti-virus programs that have been executed on the file, identifying the file in a table, 
the table including at least one anti-virus criteria for each identified file, and verifying that the list 
of one or more anti-virus programs comprised in the virus-free certificate is included in a list of anti- 
virus programs associated with the file in the table. Applicants submit that the prior art, when 
considered in combination, fails to disclose all of the features recited in claim 9. 

With regard to the rejection of claims 5, 9 and 11 under § 103(a), Applicants further assert 
that other than being related to file authentication/security in the general sense, there is an 
insufficient showing in the present § 103(a) rejection of objective evidence of record that would 
motivate one skilled in the art to modify the proposed combination of Touboul '844, Waldin, Van 
Oorschot, Hailpern, Haber and/or Ramasubramani, in order to produce the particular limitations of 
the invention set forth in the subject claims. The Federal Circuit has clearly stated that when 
patentability turns on the question of obviousness, the obviousness determination "must be based 
on objective evidence of record" and that "this precedent has been reinforced in myriad decisions, 
and cannot be dispensed with." In re Sang-Su Lee, 277 F.3d 1338, 1343 (Fed. Cir. 2002). 
Moreover, the Federal Circuit has stated that "conclusory statements" by an examiner fail to 
adequately address the factual question of motivation, which is material to patentability and cannot 
be resolved "on subjective belief and unknown authority." Id. at 1343-1344. "[T]he mere fact that 
teachings found in the prior art could be combined as proposed by an examiner does not make the 
combination obvious 'absent some teaching, suggestion or incentive supporting the combination.'" 
Ex parte Metcalf, 67 USPQ2d 1 633, 1 635 (citing Carella v. Starlight Archery and Pro Line Co. , 804 
F.2d 135, 140, 231 USPQ 644, 647 (Fed. Cir. 1986)) (emphasis added). Applicants assert that no 
such teaching, suggestion or incentive is present. While the number of references used in a rejection 
under § 103(a) cannot, by itself, be used to refute the obviousness of a claim, the fact that up to five 
references must be combined in order to sustain an obviousness rejection certainly provides strong 
evidence of non-obviousness of the claimed subject matter. 

For at least the reasons stated above, Applicants submit that claims 5, 9 and 1 1 are believed 
to be patentable over the prior art of record, not merely by virtue of their dependency from claim 1, 
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but also in their own right. Accordingly, favorable reconsideration and allowance of claims 5, 9 and 
1 1 are respectfully solicited. 

In view of the foregoing, Applicants believe that pending claims 1-13 and 15-17 are in 
condition for allowance, and respectfully request withdrawal of the §101, §1 12 and § 1 03 rejections. 



Respectfully submitted, 




Date: April 13, 2005 Wayne L. Ellenbogen 

Attorney for Applicant(s) 
Reg. No. 43,602 
Ryan, Mason & Lewis, LLP 
90 Forest Avenue 
Locust Valley, NY 11560 
(516) 759-7662 
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